The first step is to install the RMI security manager. While this is not strictly required, it does allow the server virtual machine to download class files. For example, suppose the client calls a method in this server that accepts a reference to an application-defined object type, for example a BankAccount. By setting the security manager, we allow the RMI runtime to copy the BankAccount class file to the server dynamically - that eases the configuration on the server.
The downside to letting RMI dynamically download such classes is that it's a security risk. In other words, we are essentially letting the server execute code from another machine. While we hope that these class files are not going to harm the server, if you want to avoid the risk, your RMI server should not install a security manager. You must then ensure that all class files are installed locally in the server's classpath.
And now just an aside before we move on: passing object argument types is actually a pretty involved topic, since there are two ways to do it. One way is to pass only a reference across the communication wire; the other is to serialize the object and create a new object remotely. We will not discuss these any further since we don't have enough time, so you should read the RMI documentation in the JDK for more details.